Summary: SELinux is preventing /usr/sbin/logrotate "read" access on sssd. Detailed Description: SELinux denied access requested by logrotate. It is not expected that this access is required by logrotate and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:logrotate_t:s0-s0:c0.c1023 Target Context system_u:object_r:sssd_var_lib_t:s0 Target Objects sssd [ dir ] Source logrotate Source Path /usr/sbin/logrotate Port <Unknown> Host (removed) Source RPM Packages logrotate-3.7.8-7.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.14-3.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.33-1.fc13.i686 #1 SMP Wed Feb 24 20:11:36 UTC 2010 i686 i686 Alert Count 1 First Seen Sun 21 Mar 2010 12:39:03 PM CET Last Seen Sun 21 Mar 2010 12:39:03 PM CET Local ID 4ffc2273-22ca-4f13-88ef-47d817c14dec Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1269171543.459:96): avc: denied { read } for pid=4861 comm="logrotate" name="sssd" dev=dm-0 ino=1184568 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1269171543.459:96): arch=40000003 syscall=5 success=no exit=-13 a0=bfe89e70 a1=98800 a2=29fff4 a3=0 items=0 ppid=4859 pid=4861 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5 comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,logrotate,logrotate_t,sssd_var_lib_t,dir,read audit2allow suggests: #============= logrotate_t ============== allow logrotate_t sssd_var_lib_t:dir read;
Miroslav add for F12 optional_policy(` sssd_domtrans(logrotate_t) ') You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.7.15-4.fc13.noarch
selinux-policy-3.7.15-4.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.15-4.fc13
selinux-policy-3.6.32-106.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12
selinux-policy-3.7.15-4.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.15-4.fc13
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-106.fc12
selinux-policy-3.7.15-4.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
selinux-policy-3.6.32-106.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
This is still a problem on a fresh installed F-13 (2010-03-30) system containing selinux-policy-3.7.15-4.fc13.noarch.
-bash-4.1# sesearch -A -s logrotate_t -t sssd_exec_t Found 4 semantic av rules: allow logrotate_t file_type : dir { getattr search open } ; allow logrotate_t entry_type : file getattr ; allow logrotate_t entry_type : lnk_file { read getattr } ; allow logrotate_t sssd_exec_t : file { read getattr execute open } ; -bash-4.1# sesearch -A -s logrotate_t -t sssd_t Found 8 semantic av rules: allow logrotate_t sssd_t : process transition ; allow logrotate_t sssd_t : unix_stream_socket connectto ; allow logrotate_t domain : process signal ; allow logrotate_t domain : file { ioctl read getattr lock open } ; allow logrotate_t domain : dir { ioctl read getattr lock search open } ; allow logrotate_t domain : lnk_file { read getattr } ; allow domain domain : key { search link } ; allow domain domain : fd use ; Slightly newer policy. rpm -q selinux-policy selinux-policy-3.7.16-2.fc13.noarch